Splunk Enterprise CVE-2026-76331

Exploitation requires a valid Splunk Enterprise account that does not hold the 'admin' or 'power' role - meaning low-privileged users such as read-only analysts or custom-role users are the threat actors. The attacker must have network access to the Splunk REST API (typically TCP 8089 or the configured management port). The vulnerability is triggered via the saved-search dispatch endpoint; deployments that restrict API access to trusted networks or require elevated roles for dispatch operations reduce exposure. Exploitation is limited to the authenticated user context - unauthenticated access is not possible. The CVSS vector PR:L confirms authentication is required, distinguishing this from an external, pre-auth attack.

The CVSS 3.1 score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) accurately reflects a high-severity issue that is straightforward to exploit for any authenticated Splunk user. The low privilege requirement (PR:L) is the key limiting factor - this is not an unauthenticated attack, but in enterprise deployments, Splunk often has hundreds of low-privileged users (analysts, read-only consumers) who would ordinarily not have access to sensitive indexed data from other teams or tenants. The network attack vector and low complexity make exploitation trivially automatable once credentials are obtained. No EPSS data was provided in the source intelligence; no CISA KEV listing exists for this CVE, and no public proof-of-concept code has been reported, suggesting exploitation remains opportunistic rather than confirmed in the wild. The high confidentiality and integrity impact ratings are consistent with the description: an attacker can read all indexed data and manipulate saved-search behavior, which in a SOC or data analytics context is a critical business risk. Availability is not impacted per CVSS and the description supports this. Overall this should be treated as a genuine priority for any multi-tenant or large Splunk deployment.

An attacker holding a low-privileged Splunk analyst account - one without the 'admin' or 'power' role - submits a crafted saved-search dispatch request to the Splunk REST API, embedding injected SPL commands within the time value parameters. The injected SPL bypasses the access controls normally enforced by the user's role, allowing the attacker to search and exfiltrate indexed data from across the Splunk instance, including data from security logs, business intelligence, or other sensitive sources they would not ordinarily be permitted to query.